�Q4Vn��u�!%���//)b/�4B-oL�c��7��wot|���F��<}��,�ma�����@��|q]M�B�/� �qf������s�g��/��ʯ��=� Q�?*��\qpz�h�O�'�������!i�U�2�1<Y3s����ㄟ�D�D���Ã��cw9Z�ڂ�MI|dpg�lziJ�E�v�s�N��l�pf�è��ŋ���f�iB���E�,S9�o}y\:���c`��eO��"&xc|8w>K�8���}��R��߷&�n������q�)@�H��َ9����GC�(�q�nɼ1w����Um�z���L��5�vB}�4�����`\�� ��"�1�پ�Y[�B'�<j*��9����)pI�� �\N�s��u�}�]�g��R� ��4P�j)5����7!ݩ�y%�8����:6�*%��A���϶.�ꅔ{6!��+6<��U*�2)�tpŨl+=��BĠ�l'ש�<ـ�zX�D��}�ŭ��G_p��K��g�Λ[W�/�1����`�}Z�����;DD&v'����K �)"n�9|��~�)f��ڮ��}����n����ó�q��oU������/m�:����A����s<7dn1�����T�'jZ�O��K0k�� a+�C� �3!��D]�9�ݔ|��W�u��8�sY��<l*���`T�dn�/BrS� ��*]yʞ���2r�5�YŕV��d�8S3A(�'���-�l7=���;��z�Z�y3(��oP�^�c{c��������r�4`J)����,��!�6�4�`S�z ����+}�ًYe�*Gm�%��vK����)2Ag��֠,2?��Dt���US��`��_�D/:{��CT�ī�im�z�|�0�菫ON��0���D��Tٝ9)Q�_�u��Dj��P��m�������Ͳ�Mz�A����X��;7��t�()EX�O�꿙���BJ�L"�vҪ���2��a&C�jK����g�Q�y��Iv��Na���(u��z�~�E���3���t����\DbI�q� ��z��96>+��!$$r\\b�A�O����ת>��K�PF]W�p�Cm������¬��8�kf�I�i�e26����k8�U&������|X7e�>��m�X�L?�azN�1�c�OvR!�.\0i�#�������"����-x�[K8�p�g��1AQ�a�Z���NQ�9M�1Ɖ�m)���P}���wW5��K��)ܦ�(������:;S&�a����:���;U��H�G���!�2���Q@x�����A��h��mcv]{*�Hd� ߐ�zv��GA�h��z�R���"��MzN�����=��k�)����T_����Ѕ'����~����E:�<�%HR4�/��\o����g$꣧2�ԉ��&�X��坉�{��>X�� ��R�3�J5V��XB�I��À�>��iYd��5���"�O�0������ā{����� ���Q�7����A���9��N�>�s��95�o6� ߹���oHW;v.��Z|����I��\ �9�g9&I�`�"�S�`�� ЅN����1�m钊8|��k�Õ0I2��U��0�m� �w���q�nF#+�`���/�]�W!�|�}LR�^��om��� ,�#dH�)S)����$D�>���0ǝz�w�9(� ������?�������T߾�\��usکv��x�R\���6*[P���(�*"r�փ��5����^m�͚�K���gL����l���&�">p�-V��|�m��!�z���9hѕJR���W|���S�Y�|8�N�����)u�ɓn�y���v��p����ދ��$����.G��\�C��q�����*_�^m��1�����(c�l��ԋ_����a��)Q^�?B~�""8*����>��=��{&Gύ��Ξ���X/7ܙq�}��y����_��yWL~D IL��V���}� �dZ����k�3aB�GOd��X*�抭�&4�����o.\�U~���^�$����D�K�5вf�xZ���+����Β���l�Lj����t8�"���H�˔~k�:�wm��w����/�0���q^R�Rn����"�f>dd�eF����ߺ�@�FU�W����0̄[%�7]�n�uĞ3ڕM��w,`.���r ����-C�Y�ġÀ�w�t�T�2�>���X��oS���bX��p9Z��;ݶ�[��}7����Ͳѕ t�TGn&G�9P3]�5������q��ߧ ��1�=����%��g-���?9�E�g���W���=/da��H��i�.u�1�JR���T�G�Bډ���;�QNv�� 0[n�AM�5�nl�G��#��ܯ�� ��;��H`�r$.�f��}�?��0G���@N���/�F��8c�x��P|��M N��p�� �<�wd&j� O�a�^%���������O����Lͪ�N��hsĖ$j@��t�g��r�>��="2=.<�2���CL_.�Dyr����AS��TӠ��Ⱦ; S8c�b�y���k�t��I���� ͭ�Ϣkim��[�Pj�W�8���ˁL�s�LJ�ҝ���A �:��GI��������B�*V���pC�f�p� �RKHp���90��6��J�㸣Q�>UE5X�i��� i}y�G'Ni��> ��4��C���3�@��E-O����)������G��r��MN�P��� �"��w��澶z:�+�%3�"t�Z�_�@�����g�t�� ������Y"�\�����J�%��l�a�&�fJY���ʡwB��B���ـ��B�W|`��|�d.%w:��|lRq�F���iF���x퍝O]�:B�Ӱ|r��A�j���/�=4�:\��{��ps�"��/m�p=���3i�@��[�*!t�8��Twwd�����55sQ�`�������JaA������l8ϩ�:�~}��Q7]���D�P8vi�j�k"+������q�H��8MI� c�`K���U�3���V�d���4�m}bE}*���.X 7��fn
Behavioral task
behavioral1
Sample
66fceeb24187c90970bf3b9a52348c71_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
66fceeb24187c90970bf3b9a52348c71_JaffaCakes118
-
Size
2.1MB
-
MD5
66fceeb24187c90970bf3b9a52348c71
-
SHA1
aecc1f0b45bb94182c24c4c7c04267ff703c0614
-
SHA256
db90e15803132ef763e3f21f82782ddeb725201e95f2b95d2dafc40ba8058295
-
SHA512
c937dc553ce2b447bf9bbe9cd5b96d0df8d9d9ca5d36fa8424e6eb59b643bdc535a94d984b07c5d0354f96b7d29c0ee56b28b2df0bf8e6657a44e6cc315d163d
-
SSDEEP
49152:8tF4MMbiTecwImtOOS3JAmn7oEacT9Ycz3obwv:vMMmTegHJAEcg9oUv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66fceeb24187c90970bf3b9a52348c71_JaffaCakes118
Files
-
66fceeb24187c90970bf3b9a52348c71_JaffaCakes118.exe windows:4 windows x86 arch:x86
3e4e1926842f16858755eee3cbca0fd9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetStringTypeA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMessageTime
MessageBoxA
gdi32
DeleteDC
winmm
midiOutReset
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
getpeername
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 172KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE